CVE-2023-37895

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

CVE-2023-37895

Summary: CVE-2023-37895 affects Apache Jackrabbit Webapp/Standalone via an unsafe deserialization in the commons-beanutils component, enabling remote code execution over RMI. Affected RMIs include versions up to 2.20.10 (stable) and 2.21.17 (unstable). Impact: potential remote code execution with...

CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

Apache Jackrabbit 代码问题漏洞

Apache Jackrabbit is a content repository from Apache USA. A code execution vulnerability exists in Apache Jackrabbit Webapp/Standalone, which stems from the component commons-beanutils failing to properly filter special elements of constructed snippets. An attacker could exploit the vulnerabilit...

PT-2023-5558

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions 2.20.10 and earlier stable branch Apache Jackrabbit versions 2.21.17 and earlier unstable branch Description: A Java object deserialization issue in Apache Jackrabbit webapp/standalone on all platforms allows an...

Apache Sling Input Validation Error Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to comply with JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. An input validation error vulnerability exists in Apache Sling Commons...

Debian: Security Advisory (DLA-629-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Sling JNDI Injection Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...

org.apache.archiva:archiva-webapp (>=1.4-M4 <=2.0.1), org.apache.archiva:archiva-webdav (>=1.4-M4 <=2.0.1) +13 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.6.0 <=2.6.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.6.0, =1.4-M4, =1.4-M4, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =2.6.0, =1.2.2, =2.2.2, =1.3.0-beta3, =1.0.0, =1.2.0, =1.3.0-beta2 Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

net.adamcin.recap:net.adamcin.recap.addressbook (>=0.8.0 <=1.0.1), net.adamcin.recap:net.adamcin.recap.core (>=0.8.0 <=1.0.1) +16 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.4.0 <=2.4.5)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.4.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.1.0, =2.1.2, =5.12.0, =5.11.0, =5.12.2 and more Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

com.khubla.com.pragmatach.examples:jcrexample (=1.40), com.khubla.pragmatach:pragmatach-jcr (=1.40) +15 more potentially affected by CVE-2016-6801 via org.apache.jackrabbit:jackrabbit-webdav (>=2.8.0 <=2.8.2)

org.apache.jackrabbit:jackrabbit-webdav MAVEN version =2.8.0, =2.1.0, =2.1.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =1.0.9, =1.0, =0.9.5, =5.13.1, =5.13.1, =5.22.7 and more Source cves: CVE-2016-6801 Source advisory: OSV:GHSA-9FC7-RHQ3-WM7X...

GHSA-9FC7-RHQ3-WM7X Apache Jackrabbit Authentication Hijacking Vulnerability

Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...

Apache Jackrabbit Authentication Hijacking Vulnerability

Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...

com.composum.sling.core:composum-sling-core-commons (>=1.3.1 <=1.12.4), com.composum.sling.core:composum-sling-core-console (>=1.6.0 <=1.12.4) +15 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.6.0 <=2.6.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.6.0, =1.3.1, =1.6.0, =1.4.0, =2.4.30, =2.4.30, =1.4-M4, =1.4-M4, =2.6.0, =2.6.0, =2.6.0, =1.3.0-beta3, =1.0.0, =1.2.0, =1.3.0-beta2 and more Source cves: CVE-2015-1833 Source advisory: OSV:GHSA-9284-J4C9-779Q...

com.liferay:com.liferay.portal.store.jcr (>=1.0.0 <=2.0.3), com.squeakysand.jcr:squeakysand-jcr-taglib-test (>=0.2.0 <=0.4.0) +8 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.2.0 <=2.2.13)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.2.0, =1.0.0, =0.2.0, =0.2.0, =2.10.0, =2.2.0, =2.2.0, =1.2.0-cr4, =1.2.0-cr8 Source cves: CVE-2015-1833 Source advisory: OSV:GHSA-9284-J4C9-779Q...

com.day.crx:crx-auth-ldap (=2.3.15), com.day.crx:crx-spellchecker (>=2.3.14 <=2.3.64) +14 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=2.4.0 <=2.4.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.4.0, =2.3.14, =2.3.14, =0.6.0, =2.4.0, =2.4.0, =2.4.0, =5.12.0, =5.11.0, =5.11.0, =5.11.0, =5.12.2 and more Source cves: CVE-2015-1833 Source advisory: OSV:GHSA-9284-J4C9-779Q...

com.cosium.murmur:vysper (=0.8), com.day.cq:cq-compat-codeupgrade (>=1.0.2 <=1.2.10) +39 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (>=1.2.1 <=2.0.5)

org.apache.jackrabbit:jackrabbit-core MAVEN version =1.2.1, =1.0.2, =5.3.4, =3.2.10-1-SP3seam2hibernate5, =3.2.10-1-SP3seam2hibernate5, =3.2.10-1-SP3seam2hibernate5, =3.2.10-1-SP3seam2hibernate5, =3.2.10-1-SP3seam2hibernate5, =3.2.10-1-SP3seam2hibernate5, =6.0.2, =1.1.2, =0.4.0-incubating, =1.3.0...

io.inkstand:inkstand-jcr-jackrabbit (>=0.1.1 <=0.1.3), io.inkstand:scribble (>=0.1.0 <=0.2.0-alpha3) +23 more potentially affected by CVE-2015-1833 via org.apache.jackrabbit:jackrabbit-core (=2.8.0)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-core and may be impacted: - io.inkstand:inkstand-jcr-jackrabbit =0.1.1, =0.1.0, =0.3.0, =0.3.0, =0.4.0, =0.4.0,...

GHSA-9284-J4C9-779Q Improper Input Validation in Apache Jackrabbit

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...